Critical PHP Flaws Could Let Hackers Take Over Church Websites
Congregations are urged to act now, even if someone else manages their site
NASHVILLE, Tenn. – Two critical security vulnerabilities in PHP, the programming language behind millions of websites, could allow attackers to take control of church websites without ever needing a password. GCFA is urging congregations, conferences, and United Methodist agencies to treat the threat as a high priority. This is already being used to exploit websites.
The flaws, known collectively as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), each have a severity score of 9.2 out of 10 on the CVSS v4.0 scale, which is rated “Critical.” They could allow an unauthenticated attacker to remotely run malicious code on a vulnerable website or web application.
What is at stake
A successful attack could mean unauthorized access to systems, a compromised or defaced church website, disrupted online services, and the exposure of sensitive information. For congregations that depend on their websites for livestreamed worship, online giving, event registration, and member communications, the consequences could reach well beyond an embarrassing homepage.
“My site is managed by someone else” is not a safeguard
Many churches do not manage their own websites and applications. Their sites are built by a volunteer, a vendor, or a hosting company. But PHP powers popular platforms such as WordPress and Drupal, and exposure does not stop at the church door. Organizations may be affected even when an outside provider hosts or manages their website.
GCFA also cautions that updating WordPress, Drupal, or another content management system does not necessarily update the underlying PHP installation. A site can be fully “up to date” and still be vulnerable.
The patches
The PHP development team released emergency security updates Oct. 21. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Churches running older, unsupported versions of PHP face a harder road. Those versions may never receive official fixes, and GCFA advises isolating such systems from the internet and working with a technology provider on an upgrade or other remediation.
As stated earlier, this hack is being actively exploited in real-time. Web application firewalls may offer extra protection, but they are not a substitute for installing the patches.
What churches should do now:
Find out what you are running. Ask your IT contact, web administrator, or hosting provider whether your website or any church application uses PHP, and which version. DO THIS TODAY.
Get the patch installed. Ask your provider to apply the official PHP security updates as soon as possible. Do not assume it has happened.
Ask for confirmation in writing. Request that your web developer or host confirm they have assessed these vulnerabilities and applied and verified the necessary PHP security updates.
Consider taking exposed sites offline. If a public-facing site cannot be patched promptly, restricting access or temporarily taking it down may be the safer choice.
Check for unsupported software. Identify any site running an end-of-life PHP version and plan an upgrade.
Watch for warning signs. Review web server, application, and security logs for suspicious activity, or ask your provider to do so.
No cause for panic, but every reason for urgency
Receiving this advisory does not mean an organization has been compromised or is confirmed to be vulnerable. The goal is to reduce risk before attackers can take advantage of the flaw.
Given the critical severity of these vulnerabilities and the potential for remote code execution, this should be treated as a high-priority security matter, especially for internet-facing websites and applications. GCFA will continue monitoring developments and will provide additional guidance.
Where to get help
GCFA UMC Support offers technology services. For more information about how GCFA can help you with IT needs, please visit UMC Church IT Support Services | General Council on Finance and Administration. Official PHP release information is available at php.net.
